Privacy Policy

The data controller for the Service is Moments Photos (“Moments”, “we”, “us”, “our”). Our address is Contact support@moments.photos for our registered business address..

You can contact us at support@moments.photos. If required for your use case, you may also designate a Data Protection Officer (DPO) and list their contact details here.

• Account data: name, email address, authentication and security information (for example, verification tokens), and basic account preferences.
• Event and gallery data: event titles/descriptions, dates, share codes, guest identity preferences, and related settings.
• Uploads (User Content): photos and other media you or your guests upload, along with related metadata you provide.
• Usage and device data: IP address, device/browser/screen information, pages viewed, approximate location derived from IP, interaction events (for example clicks and scroll depth), Core Web Vitals, and logs necessary to operate and secure the Service. Depending on your analytics choice, this may also include a first-party browser identifier, session replay, and heatmaps (see section 5).
• Billing data: purchase status, plan selections, receipts/invoices and transaction identifiers. Payment card details are handled by our payment provider, not stored by us.
• Support/contact data: messages you send us and related contact details.

We use information to:

• Provide and operate the Service (accounts, event galleries, uploads, downloads).
• Process purchases and provide invoices/receipts.
• Prevent abuse, enforce our terms, and secure the Service.
• Communicate with you about your account and the Service (transactional emails).
• Send marketing communications where permitted (you can opt out at any time).
• Measure and improve the Service (analytics).

If you are in the EU/EEA or UK, we rely on the following legal bases under GDPR/UK GDPR:

• Contract: to provide the Service you request (account, event galleries, storage, downloads).
• Legitimate interests: to secure and prevent abuse of the Service, and to measure and improve it with anonymous first-party analytics (see section 5).
• Consent: for marketing emails where we rely on it. You may withdraw that consent at any time. Additional analytics (session replay, a persistent browser identifier, and the Meta Pixel) run unless you reject them in the on-site banner; rejecting is how you object to that processing.
• Legal obligation: where we must comply with law (for example, tax/accounting obligations).

We use analytics to understand how the Service is used and to improve it. Analytics is organised in two tiers. We do not use Google Analytics.

Essential (always on). Anonymous, first-party measurement through our self-hosted Umami instance. This records page views and sessions, the page or link you came from (including campaign parameters), approximate location from your IP address, device/browser/screen information, product events (for example creating an event or uploading a photo), scroll depth, time spent on a page, and Core Web Vitals. It does not set a persistent identifier that recognises your browser across visits. Sensitive values in URLs (for example password-reset tokens) are removed before data is stored, and pages under /admin are not tracked.

Additional (on unless you reject). A banner on the site lets you Accept or Reject this tier. Until you Reject, and if you dismiss the banner without choosing, this tier stays on. Rejecting turns it off immediately and stores that choice in your browser. Additional analytics includes:

• A persistent first-party identifier stored in your browser so we can recognise returning visits. If you later sign in, we may replace that identifier with your account ID so pre-signup browsing can be joined to your account. We do not send your name, email address, or phone number to Umami or Meta.
• Session replay and heatmaps (Umami recorder): recordings of how you interact with pages (clicks, scrolling, and similar). Form inputs are masked according to the recorder’s settings on our Umami instance.
• Meta Pixel: cookies or similar identifiers and conversion events (for example sign-ups and purchases) shared with Meta for advertising measurement and campaign optimisation.

To turn additional analytics off, choose Reject on the banner. If you already accepted or the banner is no longer showing, you can clear site data for this website (which clears the stored choice) and Reject when the banner appears again, or contact us at support@moments.photos. You can also block cookies and third-party scripts through your browser settings; that may limit parts of the Service.

We send transactional emails (for example, verification and password reset) to provide the Service. We may also send marketing emails if you opt in or where permitted by law.

Our current email delivery provider for authentication emails is Plunk. If we use additional email marketing providers, we will list them here.

You can opt out of marketing emails by using the unsubscribe link in those messages or by contacting us at support@moments.photos.

We use third-party payment/checkout providers to process payments and generate invoices/receipts. Our current integration includes Polar for checkout and invoice URLs.

We receive confirmation of purchases, transaction identifiers, and related billing metadata necessary to fulfill your purchase and support accounting.

We may share information:

• With service providers (processors): hosting, storage (for uploads), email delivery, analytics, and payments.
• With event participants: content you upload to an event may be visible to hosts and guests you authorize through the event link/code and settings.
• For legal and security reasons: to comply with law, enforce our terms, or protect rights and safety.
• Business transfers: if we are involved in a merger, acquisition, or sale of assets.

We may process data outside your country. If you are in the EU/EEA/UK and your data is transferred to countries without an adequacy decision, we will rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) and/or the UK International Data Transfer Addendum/IDTA, as applicable.

We retain personal data as long as necessary to provide the Service and for legitimate business needs (for example, security, dispute resolution, and compliance with legal obligations).

• Account data: retained until you delete your account, subject to legal retention requirements.
• Uploads: retained while the event/gallery is active or as configured by the host, subject to plan limits and deletion requests.
• Billing records: retained as required by tax and accounting laws.
• Analytics: first-party Umami data is retained on our analytics instance for product measurement. A rejection stops additional analytics from that point forward; it does not erase essential pageviews already recorded.

We use administrative, technical, and physical safeguards designed to protect information. However, no method of transmission or storage is 100% secure.

If you are in the EU/EEA or UK, you may have rights to access, correct, delete, or port your personal data, and to restrict or object to certain processing. You also have the right to withdraw consent where processing is based on consent.

To exercise these rights, contact support@moments.photos. You also have the right to lodge a complaint with your local supervisory authority.

Depending on your state of residence, you may have rights to access, delete, or correct personal information, and to opt out of certain disclosures of personal information (for example, “sale” or “sharing” for targeted advertising as defined by applicable law).

Sale / sharing: We do not sell personal information in exchange for money. The Meta Pixel (additional analytics, section 5) may qualify as “sharing” for targeted advertising under some US state laws. Choosing Reject on the cookies and analytics banner opts you out of that sharing.

To make a request, contact support@moments.photos. We may need to verify your request.

The Service is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify you. The effective date above reflects the latest version.

Please also review our Terms & Conditions.